VMware Vsphere Data Protection vulnerabilities

8 CVEs affecting VMware Vsphere Data Protection, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-11077, published 2018-11-26.

More from VMware.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2016-7456, published 2016-12-29. Critical severity, CVSS 9.8. EPSS: 32.8% chance of exploitation in the next 30 days. VMware vSphere Data Protection (VDP) 5.5.x though 6.1.x has an SSH private key with a publicly known password, which makes it easier for remote attackers to obtain login access via an SSH session.
• CVE-2018-11066, published 2018-11-26. Critical severity, CVSS 9.8. EPSS: 9.9% chance of exploitation in the next 30 days. Dell EMC Avamar Client Manager in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1, 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0,…
• CVE-2017-4914, published 2017-06-07. Critical severity, CVSS 9.8. EPSS: 8.8% chance of exploitation in the next 30 days. VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance.
• CVE-2018-11067, published 2018-11-26. Medium severity, CVSS 6.1. EPSS: 1.8% chance of exploitation in the next 30 days. Dell EMC Avamar Client Manager in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1, 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0,…
• CVE-2018-11077, published 2018-11-26. Medium severity, CVSS 6.7. EPSS: 1% chance of exploitation in the next 30 days. 'getlogs' utility in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1 and 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 and 2.2…
• CVE-2017-4917, published 2017-06-07. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x locally stores vCenter Server credentials using reversible encryption. This issue may allow plaintext credentials to be obtained.
• CVE-2018-11076, published 2018-11-26. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0 and 7.4.1 and Dell EMC Integrated Data Protection Appliance (IDPA) 2.0 are affected by an information exposure vulnerability. Avamar…
• CVE-2014-4632, published 2015-02-01. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. VMware vSphere Data Protection (VDP) 5.1, 5.5 before 5.5.9, and 5.8 before 5.8.1 and the proxy client in EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x do not properly…